The file "hstart.exe" is known to be created under the following filenames:

%AppData%\hide.exe

%System%\gorun.exe

%Temp%\hstart.exe

%Temp%\rarsfx0\hstart.exe

%Temp%\rarsfx0\loader\hstart.exe

%Temp%\rarsfx1\hstart.exe

c:\recycler\s-1-5-update\dmgr.exe

Notes:

%AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.

%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

The following threat is known to be associated with the file "hstart.exe":